What’s new
UniconOS & Management 2609
Release date 2026-10-13
Important:
Please review the information regarding the removal of legacy UniconOS Management components in the Deprecation section of these release notes.
New Features
Authentication & SSO
- Imprivata browser-based SSO in Chrome (extension + appliance). Users can now sign in to web applications in Chrome with their Imprivata credentials, through a browser extension that talks directly to the Imprivata appliance. This extends badge-based single sign-on beyond published desktops to browser-delivered applications. [ELUX-6950]
- Imprivata badge/proximity login in companion mode — Type 2. Adds support for Imprivata companion mode (Type 2), where a badge tap on a paired companion device authenticates the user at the endpoint. This gives shared-workstation deployments another supported tap-to-login topology. [ELUX-8052]
-
Configurable Imprivata proximity-reader names via
terminal.ini. The set of proximity reader models UniconOS recognizes can now be extended throughterminal.iniinstead of being fixed in the build. Sites using readers outside the default list can enable them without waiting for a new release. [ELUX-8373] - Set default domain for login screen. Administrators can define a default Active Directory domain for the Active Directory, Active Directory with smart card, and Imprivata login screens, so users no longer type or pick a domain at every sign-in. The default is set centrally in UniconOS Management and pushed to the devices. [CTXBV-3098] [SBD-1996]
- EntraID authentication via UniconOS headless Chrome with SSO to CWA (with and without UniconOS Authentication Manager). Users can authenticate against Microsoft Entra ID at the endpoint using Chrome, including FIDO2 security keys, and that identity carries through into Citrix Workspace™ App without a second prompt. The integration also moves to a new Entra application ID, replacing the legacy Unicon AVD client registration. [CTXBV-4041]
- Logging in to the Scout Board in the Citrix Cloud environment is performed without entering the Citrix Cloud Organization ID. Administrators can sign in to the management console without entering the Citrix Cloud Organization ID. This removes a step that was easy to mistype and slowed down everyday console access. [SBD-2236]
- PureAuth offline login via PIN. Users enrolled with PureAuth can unlock a device using a PIN when the authentication service cannot be reached. Endpoints stay usable during a network or service outage instead of locking staff out. [ELUX-7543]
Desktop & user experience
- Dynamic information on the UniconOS logon screen. A configurable information tile now appears on the UniconOS logon screen beneath the product logo, showing device identity such as hostname alongside admin-authored text. Helpdesk can identify an endpoint before anyone signs in, and the content is configured centrally in UniconOS Management. [CTXBV-3893]
- Display of device information on the wallpaper of the UniconOS desktop. Device information such as hostname, address and firmware level can now be rendered as an overlay directly on the desktop wallpaper. Administrators choose centrally what is displayed, so support staff get the details they need without opening a settings dialog. [CTXBV-3140]
- Taskbar follows the active monitor with auto-hide on multi-monitor setups. On multi-monitor setups with auto-hide enabled, the taskbar now reveals on whichever monitor the user is working on rather than staying pinned to the primary display. Users no longer have to move the pointer across screens to reach it. [ELUX-6495]
- Published App Options and Auto-Open Self-Service for StoreFront™ connections on UniconOS. Published StoreFront applications can be shown directly on the desktop wallpaper, with a choice of Favourites, All or None, so users reach their applications without opening Self-Service first. The All option is scoped to its own StoreFront connection, and Self-Service now opens the Workspace App picker automatically once a store has been added. [CTXBV-4058]
- Native user pinning in the Unicon dialog stack. User pinning is now implemented natively in the UniconOS dialog stack instead of relying on the previous workaround. Behavior is more consistent when a user is pinned to a device. [ELUX-8001]
- Notifications now bring their application window to focus. Selecting a desktop notification now brings the application that sent it to the front, so users can act on an alert immediately. Previously they had to find the application manually in the taskbar. [ELUX-8084]
- Configurable battery level threshold for firmware update. Administrators can set the minimum battery level a device must have before a firmware update is allowed to start, preventing updates on devices at risk of losing power mid-flash. Update notification behavior is now configurable too, so administrators control what end users see while an update runs. [CTXBV-3266]
-
Configurable SKY desktop icon size, app-label font size, and system bar height via
terminal.ini. Administrators can set the SKY desktop icon size, the app-label font size, and the system bar height throughterminal.ini. This adapts the desktop to accessibility requirements and to different screen sizes. [ELUX-7462] - Change the Citrix Workspace App AllowAudioInput default to ON. The Citrix Workspace App setting that permits microphone input is now switched on by default. New deployments get working audio input in sessions without an extra configuration step. [SBD-1959]
Input, accessibility & localization
- Enhance HID Device Configuration for an Improved User Experience. Touchpad and pointer behavior can now be matched to user preference, covering two-finger pinch-to-zoom, classic or natural scroll direction, and a user-settable cursor size. The Dvorak keyboard layout is also available for EN-US and EN-UK. [CTXBV-3297]
- On-Screen keyboard on UniconOS, configurable via Scout Board. The on-screen keyboard can be enabled, disabled and configured centrally from UniconOS Management rather than device by device. Administrators can also lock the setting through User Rights so end users cannot change it. [CTXBV-3268]
- Enhance Language Support in UniconOS. UniconOS now ships Dutch translations and full Hebrew right-to-left support. Organizations in those languages can deploy without an English-only user interface. [CTXBV-3032]
Security, kiosk & lockdown
- Boot to VDI. Devices can launch directly into a Citrix VDI session in full-screen mode without granting access to the desktop, effectively turning the endpoint into a dedicated-purpose terminal. For devices without a configured authentication method, a lock screen using a local password is also available, allowing a shared device to be locked and unlocked even in this scenario. [CTXBV-3000]
- Enable Dual Boot Deployment of UniconOS and Windows for Business Continuity & Disaster Recovery (BCDR). Dual-boot deployments can encrypt the UniconOS partition. The boot menu is driven from UniconOS Management, so the default operating system and boot delay are set centrally. [CTXBV-3290]
- Option to suppress all OS USB and hardware notifications. Administrators can suppress all operating system USB and hardware notifications on a device. This keeps the screen clear in kiosk and clinical settings where pop-ups distract users or cover the application. [ELUX-6968]
- End-user hardware self-add to the device whitelist. End users can add a connected device to the hardware whitelist themselves, within the limits the administrator permits. This removes a helpdesk round-trip each time someone attaches an approved peripheral. [ELUX-7264]
- Cisco Secure Client updated to 5.1.19.1862. The bundled Cisco Secure Client is updated to release 5.1.19.1862. Customers get the current vendor fixes and a supported client version without building a custom image. [ELUX-8386]
Deployment, VDI & migration
-
igel2UniconOS Wi-Fi migration (WPA2-PSK and WPA2-Enterprise/802.1X). IGEL and Stratodesk devices can be migrated to UniconOS over Wi-Fi with no wired connection. The new
--wifiparameter ofigel2elux.shconnects the recovery system overwlan0using the Wi-Fi configuration shipped in8021conf.xz. WPA-PSK and WPA-Enterprise (EAP-TLS) are supported, and the Wi-Fi configuration and certificates are carried over to the migrated device so it rejoins the network and can onboard unattended. [ELUX-7893] [ELUX-9615] [ELUX-10144] -
Windows 11 support in the Win2UniconOS migration tool. The migration tool, formerly
win2elux, now migrates UEFI devices that run Windows 11 as well as Windows 10 to UniconOS. Existing Windows 11 devices can be repurposed as UniconOS endpoints without buying new hardware. The executable is renamed toWin2UniconOS.exe, so scripts and deployment tasks that startwin2elux.exemust use the new name. [CTXBV-3029] [ELUX-9639] - Built-in browser keeps the ICA® session alive after the StoreFront browser is closed. Closing the StoreFront browser window no longer terminates the running ICA session. Users who close the launch page by mistake keep working instead of losing their session. [ELUX-7570]
Connectivity & hardware
- Support eSIM in UniconOS. UniconOS now supports eSIM, so devices can detect eSIM hardware and download, activate, deactivate, delete and name eSIM profiles. SIM slot handling is also proper now: a WWAN profile binds to a specific modem and slot and switches automatically, which supports devices carrying both a physical SIM and an eSIM. [CTXBV-2985]
- MediaTek MT7961 (Filogic 330) Wi-Fi/Bluetooth firmware. Firmware for the MediaTek MT7961 (Filogic 330) Wi-Fi and Bluetooth chipset is now included. Devices built on this chipset get working wireless and Bluetooth out of the box. [ELUX-7798]
- fwupdmgr updated to 2.1.1 (Dell SD25TB4 dock firmware). fwupdmgr is updated to 2.1.1 so it correctly detects and reports firmware for the Dell SD25TB4 docking station and other devices. Administrators can reliably read and manage dock firmware across the deployed estate. [ELUX-7797]
- SNMP Environment package for UniconOS 7. The SNMP Environment package, previously available on eLux RP 6, is now available on UniconOS. Customers who monitor endpoints over SNMP can carry that tooling forward after migrating. [ELUX-3410]
- Core fonts added for Microsoft Edge. The Microsoft core fonts are installed alongside Microsoft Edge. Web applications and documents render with the fonts they expect instead of substituted ones. [ELUX-7288]
Device management & provisioning
- Dynamic configuration of endpoints. Device tables in Scout Board now show which rules and labels have been applied to each endpoint and when its configuration was last evaluated. Administrators can sort and filter on those columns to see at a glance why a device has the configuration it has. [CTXBV-3167]
- Fine grain monitor configuration and permissions in Scout Board and UniconOS. Administrators can control monitor settings at field level, deciding exactly which display options end users are allowed to change. The permission check is enforced on the server, so the restriction holds regardless of what the endpoint requests. [CTXBV-3170]
- More variables in UniconOS Device Naming Templates. Device naming templates gain new variables - serial number, supplier, device type and asset tag - so device names can be built from real inventory data. The template engine now behaves identically in the console, the server and the REST API, with validation at every entry point and defined behavior when names collide. [CTXBV-3300]
- Bulk command execution permissions. The bulk command execution permission also applies to commands sent to several selected devices, not only to an OU or a Dynamic Device Group. Administrators without this permission can still send a command to one device at a time. [SBD-2419]
-
Device password for user-defined commands. User-defined commands in the UniconOS Command Scheduler need the device password wherever they are created or changed. The Scout Board scheduler dialog already asked for it. Now the configuration and OU import wizards also ask for it when the file contains such a command, and the REST API requires a
devicePasswordfield (HTTP 403 without a valid one). Built-in commands and deletions are not affected. [SBD-2222] - Persistent Home option for USB audio devices. Persistent Home can now remember a user’s USB audio device selection, so the same device is used automatically after a restart instead of reverting to the default. [SBD-2269]
Cloud connectivity & transport
- Introducing a new service for device onboarding and management for Citrix UniconOS Management Cloud environments. The Scout Cloud Gateway is being replaced by the Device Enrollment Service and the Scout WebSocket Service, giving cloud-managed devices a certificate-based, mutually authenticated connection. Administrators manage enrollment tokens and device certificates directly in Scout Board. There will be a migration phase in place, and the new services will be introduced step by step in the coming weeks. [CTXBV-3007]
Platform & administration
- Suppress Browser Prompts in UniconOS for seamless user experience. Browser pop-ups such as save-password and set-as-default prompts can be suppressed, so users in kiosk and shared environments are not interrupted. The behavior is opt-in, configurable per browser, and can be locked from UniconOS Management. [CTXBV-3309]
-
Logs moved to
/var/log. System logs now live in the standard/var/loglocation. Support staff find logs where they expect them. [ELUX-7235] - Screen-mirroring banner now shows on locked sessions. A locked session that is being mirrored from UniconOS Management now shows the screen-mirroring banner, which previously appeared only on active sessions. This closes a privacy gap where a user could be observed at the lock screen with no indication. [ELUX-5010]
- Removed legacy multimedia-stick support (replaced by BCR). Legacy multimedia-stick support has been removed and is replaced by Browser Content Redirection. Customers still relying on the old mechanism need to move to BCR. [ELUX-2829]
- Write REST API actions to the audit logs, like the Scout Board UI does. Actions performed through the REST API are now written to the audit logs, matching what the user interface has already recorded. Administrators get a complete audit trail regardless of how a change was made. [SBD-2156]
- Public REST API endpoints for Preferences → Devices: OU filters. The public REST API now exposes the Preferences to Devices OU filters. Automation can read and set the same filtering administrators configure in the console. [SBD-2437]
- Scout Board REST API tokens have a maximum lifetime. A longer lifetime requested at login is reduced to the maximum. Malformed login requests return HTTP 400. [SBD-2272]
-
Scout Board on a separate server needs the DBLayer service key. Scout Board no longer retrieves this key over the network. If Scout Board runs on a different server than the Scout Board DBLayer service, set
ZERO_MQ_PUBLIC_KEYin Scout Board’s.envfile to theDBLayerPublicKeyvalue in the[Certificates]section ofdblayer.inion the DBLayer server, then restart Scout Board. When both run on the same server, nothing needs to be done. [SBD-2113] - Device names follow the name template when “Apply name template only to new devices” is off. UniconOS Management applies the OU’s template at every check-in, and Scout Board applies it when an OU is moved. Before, an existing device was renamed only when it moved to another OU. The option is activated by default. When turned off, devices whose names differ from the template, for example names edited by hand, are renamed at their first check-in after the update. [SCOUT-2465] [SBD-2305]
- The maximum file size applies to every Scout Board upload. The maximum file size applies to every Scout Board upload, including configuration import, labels and files. A value of 0 or less is rejected. [SBD-2293] [SBD-2294] [SBD-2295]
What’s new
Copied!
Failed!